Attachment 0001 - Performance Work Statement - 22OCT2024.pdf

Performance Work Statement for Document Shredding Services

1.0 Background

1.1 Crane Army Ammunition Activity (CAAA) is a tenant activity located within Naval Surface Activity Crane, located in southern Indiana. Crane Army Ammunition Activity operates within multiple facilities on base and requires recurring secured document shredding and disposal services in those locations.

1.2 Crane Army Ammunition Activity (CAAA) has a need to acquire standardized destruction services of documents for multiple CAAA buildings. This material will be called Controlled Unclassified Information (CUI) material waste throughout this document. The CUI material waste (i.e.: For Official Use Only, Sensitive but Unclassified (SBU), and Personally Identifiable Information (PII) must be destroyed to prevent inadvertent compromise, which means the data must be rendered unrecognizable and beyond reconstruction.

1.3 This requirement stems from various federal regulations that require CUI material waste to be disposed of by rendering the material unrecognizable and beyond reconstruction as stated within Department of Defense (DoD) Regulation 5400.11-R (DoD Privacy Program), NIST SP 800- 88 & DoDI 5200.48 Controlled Unclassified Information. In reference to NIST SP 800-88; The data shall be destroyed using cross-cut shredders that produce 1mm x 5 mm (0.04 in x 0.2 in) particles or smaller or pulverized or disintegrated using disintegrator devices equipped with a 3/32 in (2.4 mm) security screen. To preclude the necessity of having an CAAA employee present during destruction, the Contractor must include safeguard provisions required in DoD regulation 5400.11-R and DoDI 5200.48 Controlled Unclassified Information.

2.0 Scope of Work to Complete

2.1 The Contractor shall provide all labor, personnel, equipment, supplies, secure vehicles, materials, supervision, and other related services necessary to provide commercial CUI waste material destruction services for CAAA CUI material waste located at CAAA.

2.2 CUI material waste containers and applicable locks will be provided by the Contractor at quantities agreed upon by both the Contracting Officer, COR and the Contractor. The current estimated quantity is 47 containers- 64-gallon capacity.

2.3 Attachment (1) to the order outlines estimated number of bins per building. The Contractor shall furnish CUI material waste containers and applicable locks without additional cost to the Government. The Contractor may advise the type and size of the containers as a result of their expertise and experience, but not place the container without prior approval from the COR.

2.4 Initial pick-up schedule shall be:

2.4.1 Initial pick up to begin within 16 business days of the effective award date, and every month after the effective date of award, during the business hours identified.

2.4.2 Normal business hours are Monday- Thursday 0600-1630, excluding federal holidays.

2.5 Due to changes in operations, it may become necessary to increase or decrease the number of shred bins or modify the location of shred bins. The locations of shred bins are subject to change. The Government will notify the Contractor of location changes within 5 business days of any changes.

2.6 Contractor may adjust pickup frequencies and bin distribution based on the following criteria when agreed to by Contracting Officer Representative and Contracting Officer :

2.6.1 Most containers are consistently less than ½ full – consider fewer bins and/or less frequent pick-ups.

2.6.2 Any containers consistently full prior to scheduled pick-up – consider additional bins, and/or redistribution of existing bins.

2.6.3 Contractor shall not provide additional bins unless requested/approved by the COR and Contracting Officer.

2.7. A pick-up schedule will be provided by the Contractor no later than 10 business days after contract award for review and approval by the COR, technical POC and Contracting Officer. The Contractor will only pick up bins according to the pick-up schedule unless specifically requested by the COR.

2.8. Buildings will be on a scheduled basis for pick-ups. A current list of buildings will be provided as Attachment one (1). Pick-ups will be on a monthly basis for each location, unless otherwise specified by the COR and Contracting Officer.

2.9. If on-site shredding services are not provided, the Contractor will take all appropriate measures to ensure the safeguarding of CAAA CUI material waste as prescribed in Department of Defense (DoD) Regulation 5400.11-R (DoD Privacy Program) and DoDI 5200.48 Controlled Unclassified Information.

3.0 Work Expectations

3.1 The Contractor shall furnish all services, materials, supplies, labor, equipment, investigations, studies, superintendence, and travel as required, in connection with the performance of work described herein. The Contractor shall comply with applicable Federal, State, and Local laws, regulations, and guidance; and perform all work in accordance with these requirements and any applicable agreements.

3.2 The Contractor shall be responsible for obtaining and maintaining any registration or certification as required by the various Federal, State, and Local regulatory agencies, and any other registrations, certifications, licenses, permits, warrants, or other credentials or permissions required to perform the contracted tasks.

3.3 The Contractor’s cost proposal shall include all costs for the work items described herein and shall fully document all assumptions made for accomplishment of all tasks described herein.

3.4 To gain unescorted access to NSA Crane, the Contractor is required to enroll in the Defense Biometric Identification System (DBIDS) for any contractor employee requiring access to NSA Crane.

3.5 To gain unescorted access to CAAA facilities, The Contractor is required to obtain a CAAA door access badge.

3.6 All Contractor employees shall be required to display their Government-issued DBIDS badge while inside all CAAA buildings.

3.7 The provisions of this contract allow for the CAAA inspection of the contractor facility and operations to ensure the safeguarding of CAAA CUI material waste.

3.8 The Contractor shall take all appropriate measures to prevent the unauthorized disclosure of CUI material waste. Every Contractor employee must be aware that the information must be protected and of the methods that will be used to protect the information until it is destroyed. CAAA shall have the right to inspect the offices and plants of work under this contract. On the basis of such inspection, specific remedial measures may be required in cases where the Contractor is found to be noncompliant with contract safeguards. All information collected from the bins for CAAA must be treated as sensitive and must therefore be safeguarded so as to prevent any unauthorized disclosers and/or inspections of the data and/or records, at any time.

3.9 Contractor shall adjust pickup frequencies and bin distribution to maximize efficiencies and minimize trips based on the above criteria when agreed to by the Contracting Officer Representative (COR).

3.10 Contractor will abide by all applicable regulations pertaining to Government document handling and destruction. Regulation 5400.11-R (DoD Privacy Program), NIST SP 800-88, and DoDI 5200.48 Controlled Unclassified Information.

3.11 The Contractor shall be responsible for management, oversight, security, and control of all CUI material waste stored in the bulk containers, prior to and until completion of shredding/destruction of the material.

4.0 Shredding Specifications

4.1 CUI waste material will be removed or obliterated, or the media destroyed, in such a manner that the information is totally unrecoverable. This requirement stems from various federal regulations that require CUI material waste to be disposed of by rendering the material unrecognizable and beyond reconstruction as stated within Department of Defense (DoD) Regelation 5400.11-R (DoD Privacy Program), NIST SP 800-88, and DODI 5200.48 Controlled Unclassified Information. In reference to NIST SP 800-88; The data shall be destroyed using cross-cut shredders that produce 1mm x 5 mm (0.04 in x 0.2 in) particles or smaller or pulverized or disintegrated using disintegrator devices equipped with a 3/32 in (2.4 mm) security screen.

5.0 Certificate of Destruction

5.1 The Contractor shall prepare and submit, as an attachment to each monthly invoice, a

Certificate of Destruction for all pick-ups covered by the invoice period. These certificates must be provided no later than the 15th of each month for all materials destroyed for the previous month. If the invoicing system (WAWF) attachment application is inoperable, a soft copy of the certificate shall be sent to the COR. The COR will provide a copy of the Certificates of destruction to the CAAA Security Office for audit purposes. The Contractor shall maintain proper records and provide monthly reports concerning each Certificate of destruction issued for the duration of the contract.

5.1.1 Pick-Up/Delivery Location(s) (Including building number(s))

5.1.2 Pick-Up/Delivery Date

5.1.3 Number of pounds of shredded waste

5.1.4 Destruction Certificate Date

5.1.5 Date waste was destroyed

6.0 Contractor Personnel

6.1 Pending notification of investigation results and receiving a DBIDS badge, the Contractor may request visitor passes for up to 28 days for each employee. Visitors must obtain the visitor badge from the visitor center outside the Crane gate. Visitors must enter through the Crane gate unless otherwise authorized by security. The Contractor shall provide a list of employees that will require a Visitor Badge to the COR.

The request shall include the following:

6.1.2 Contractor’s company name and address

6.1.3 Employee’s name

6.1.4 Nationality

6.1.5 Purpose of Visit

6.2 The Contractor shall be responsible for coordinating with the COR and providing all information required of their employees for performance of work. All security requirements shall be met, and employees cleared, prior to the Contractor performing work under the contract. Employees that cannot meet the security requirements and clearance requirements will not be allowed to perform work under this contract. The Contractor shall retain documentation on file for completed investigations, for all shredding contractors, for the COR and/or Security POC to inspect before granting them access to CAAA CUI material waste.

6.3 Contractor personnel working within NSA Crane will be required to be eligible to enroll in the Defense Biometric Identification System (DBIDS).

6.4 All Contractor employees shall be required to display their Government-issued DBIDS badge while inside all CAAA buildings.

6.5 Contractor personnel working in pursuit of this contract must abide by the terms of regulations outlined in 32 CFR Part 250, DoD Directive 5230.25, and Arms Export Control Act 22 U.S.C 2751 , regarding employment of foreign nationals.

7.0 Contractor Vehicles

7.1 All Contractor vehicles utilized in the performance of this contract shall be insured (up to the minimum coverage required by the respective state) and maintain current state vehicle registration. All Contractor vehicles are subject to inspection prior to being granted access to the installation.

7.2 All Contractor employees who operate vehicles shall possess a valid State Driver’s license. The Contractor or their employees, while performing under this contract, shall use no personal vehicles. The Contractor shall ensure that all Contractor vehicles utilized under this contract are kept in proper working condition. The vehicles shall be free from oil leaks and in a safe operating condition.

7.3 The Contractor vehicles shall be locked and properly secured while at the Government site(s) or Contractor site(s). Vehicles used in the performance of the contract shall not be left unlocked while transporting CAAA CUI material waste.

7.4 In the event that a vehicle, transporting CAAA CUI material waste, is involved in an accident and the security of the material waste is compromised, the Contractor employee shall immediately contact the technical POC, COR, and Contracting Officer.

8.0 CUI Material Waste Containers

8.1 The Contractor shall deliver the required number of locked CUI material waste containers with key-locking lids at the locations specified above within eight (8) business days of the effective date of award. The containers shall be placed at the designated locations as directed by the technical POC, COR and / or Building POC.

8.2 The containers provided shall be of approximately a 64 gallon capacity size, unless otherwise approved by the technical POC, COR and Contracting Officer.

8.3 The containers shall be kept locked at all times. The Contractor shall provide five bulk container keys to CAAA that will be maintained by the CAAA security office. Keys shall not be provided to Contractor employees while performing scheduled CUI material waste pickups. The Contractor is responsible for maintaining all bulk containers in sound, odor-free, safe condition. Console type bins are prohibited from being used for CAAA CUI material waste and shall not be utilized under this contract.

8.4 Lost Keys/Locks – CAAA will be responsible for the cost of replacing bin locks or keys when CAAA is responsible for the loss of keys/locks. The Contractor shall be responsible for replacing bulk container locks or keys if they are responsible for the loss of keys/locks.

8.5 Special Pickups – Boxes/Bins – If a CAAA building has a request for shredding to occur out of the normal schedule or as a large one-time request, a modification to add separate funding may be added to the order, or the COR will contact the Contractor and arrange for this special request to be met utilizing existing funding. The Contractor shall provide additional bin(s) to the appropriate building POCs to accommodate these special pickups. CAAA employees shall place the contents into the bin(s) for pickup by the Contractor. The exception would be if the shredding is taking place on the subcontractor’s truck (mobile shred). In the case of mobile shredding, the COR would only need to notify the Contractor of the number of boxes and type of material to be shredded, ahead of time, and the Contractor will accommodate them.

9.0 CUI Waste Pick-up Schedule

9.1 Pick up Schedule:

9.1.1 Monthly, within 16 business days of the effective date of award and monthly thereafter.

9.1.2 Normal business hours are Monday- Thursday 0600-1630, excluding federal holidays. The contractor shall pick up waste during the business hours listed unless otherwise agreed to by the COR and the contractor.

9.2 In the event of any emergency, the Contractor may be required to make additional pick-ups on an on call basis for these locations. The Contractor shall respond within 1 business day from receipt of call and make arrangements for pick-up within 3 business days.

9.3 The Contractor will provide a schedule of pick-ups for all buildings to the COR and the technical POC within 10 business days after beginning service. Thereafter the Contractor shall ensure the COR and technical POC has a current schedule of pick-ups for all of the buildings at CAAA. The pick-up schedule can be modified if agreed upon by both the COR and the Contractor.

9.4 Paper document shredding shall be completed within 72 hours after the time it is picked up from CAAA locations. In the event of an emergency that precludes destruction within this timeframe, the Contractor shall notify the COR and technical POC. Contractor shall report instances of inadvertent disclosure of CUI material to the COR and technical POC.

10.0 AT OPSEC Requirements

10.1 All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within 5 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

10.2 Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

10.3 Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative); or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

http://jko.jten.mil/

10.4 The contractor and all associated sub-contractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO).

This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 5 calendar days of contract award and within 5 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

10.5 Per AR 530-1, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

10.6 Include DFARS clause 252.204-7012, which requires the contractor to comply with

NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations.

Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium-or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

Performance Requirements Summary

Performance Objectives and PWS Paragraph

Performance Standard Acceptable Quality Level Method of Inspection

Paragraph 9.3 The Contractor will provide a schedule of pick-ups for all buildings to the COR and the technical POC within 10 business days after beginning service.

Delivery schedule provided within 10 days after beginning service.

100 % conformance Random Sampling / Customer Feedback

Paragraph 8.1 The Contractor shall deliver the required number of locked CUI material waste containers with key-locking lids at the locations specified above within eight (8) business days of the effective date of award.

All required containers delivered within 8 business days of date of award.

100 % conformance Random Sampling / Customer Feedback

Paragraph 9.1.1 The contractor shall begin the initial pick-up schedule within 16 business days of the effective award date, and monthly thereafter.

Contractor will begin service within 16 business days of date of award.

100 % conformance Random Sampling / Customer Feedback

Paragraph 5.1 The Contractor shall prepare and submit, as an attachment to each monthly invoice, a Certificate of Destruction for all pick-ups covered by the invoice period. These certificates must be provided no later than the 15th of each month for all materials destroyed for the previous month.

Monthly invoice submitted with Certificate of Destruction by the 15th of each month.

100 % conformance Periodic, monthly

Paragraph 9.4 Paper document shredding shall be completed within 72 hours after the time it is picked up from CAAA locations. In the event of an emergency that precludes destruction within this timeframe, the Contractor shall notify the COR and technical POC. Contractor shall report instances of inadvertent disclosure of CUI material to the COR and technical POC.

Shredding to be completed within 72 hours of pick up from

CAAA.

100 % conformance Random Sampling / Customer Feedback

Paragraph 6.4 All Contractor employees shall be required to display their Government-issued DBIDS

All contractor employees will be required to display DBIDS badge badge while inside all CAAA buildings.

while inside CAAA buildings.

Paragraph 9.2 In the event of any emergency, the Contractor may be required to make additional pick-ups on an on call basis for these locations. The Contractor shall respond within 24 hours from receipt of call and make arrangements for pick-up within 72 hours.

Responding to calls within 24 hours for emergency pickups and make arrangements for pick-up within 72 hours.

Paragraph 4.1 CUI waste material will be removed or obliterated, or the media destroyed, in such a manner that the information is totally unrecoverable. In reference to NIST SP 800-88;

The data shall be destroyed using cross-cut shredders that produce 1mm x 5 mm (0.04 in x 0.2 in) particles or smaller or pulverized or disintegrated using disintegrator devices equipped with a 3/32 in (2.4

mm) security screen

Waste will be destroyed within required specifications.

100 % conformance Random Sampling / Customer Feedback

Paragraph 3.9 Contractor will abide by all applicable regulations pertaining to Government document handling and destruction. Regulation 5400.11-R (DoD Privacy Program), NIST SP 800-88, and DoDI 5200.48 Controlled Unclassified Information.

Contractor will abide by all applicable regulations.